move commentary to issue #911; replace with note
vitzli committed
Mar 12, 2015 at 16:53 UTC
c5689fe367b134b3888cf326eaae98935d90fe90
1 file changed
+2
-31
dev/crypto-notes.md
+2
-31
@@ -2,34 +2,5 @@
2
3
### Key-pair generation
4
5
-When compared to gpg without hardware-based (P)RNG, IPFS generates key-pair
6
-alarmingly fast: it takes ipfs about 1 minute to generate 4096-bit
7
-key-pair, but for gpg it takes about 10 minutes. In the same time
8
-entropy_avail show severe drop in available entropy for gpg, but for
9
-ipfs entropy drops about 100 bits.
10
-
11
-[This issue (#911)](https://github.com/jbenet/go-ipfs/issues/911) seems to be caused
12
-by `crypto/rand` implementation in the Go programming language:
13
-
14
-1. [in UNIX-like](http://golang.org/src/crypto/rand/rand_unix.go) operating system it uses /dev/urandom device:
15
- ```
16
- // Easy implementation: read from /dev/urandom.
17
- // This is sufficient on Linux, OS X, and FreeBSD.
18
- ```
19
-
20
- For OS X that would use 160-bit Yarrow PRNG based on SHA-1 key, for FreeBSD - 256-bit Yarrow algorithm. For both operating systems /dev/random and /dev/urandom are equal.
21
-
22
-2. [in Linux](http://golang.org/src/crypto/rand/rand_linux.go#L22) it falls back to urandom in several cases:
23
- ```
24
- // Test whether we should use the system call or /dev/urandom.
25
- // We'll fall back to urandom if:
26
- // - the kernel is too old (before 3.17)
27
- // - the machine has no entropy available (early boot + no hardware
28
- // entropy source?) and we want to avoid blocking later.
29
- ```
30
-
31
- The first clause would be used for several production-class operationg systems.
32
-
33
-3. [in Windows]() it uses Windows CryptGenRandom API.
34
-
35
-According to [wikipedia](https://en.wikipedia.org/?title=/dev/random) using /dev/urandom instead of /dev/random seems to be safe.
5
+It is critical that we check cryptographic operations to ensure the right amount of entropy is being sourced.
6
+See: [Issue #911](https://github.com/jbenet/go-ipfs/issues/911)
\ No newline at end of file